CVE-2022-21808 | ByteOS Network

Vulnerability Details :

CVE-2022-21808

Assigner-jpcert

Assigner Org ID-ede6fdc4-6654-4307-a26d-3331c018e2ce

Published At-11 Mar, 2022 | 09:10

Updated At-03 Aug, 2024 | 02:53

Path traversal vulnerability exists in CAMS for HIS Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:jpcert

Assigner Org ID:ede6fdc4-6654-4307-a26d-3331c018e2ce

Published At:11 Mar, 2022 | 09:10

Updated At:03 Aug, 2024 | 02:53

▼CVE Numbering Authority (CNA)

Path traversal vulnerability exists in CAMS for HIS Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00.

Affected Products

Vendor

Yokogawa Electric Corporation

Product

Versions

Affected

versions from R3.08.10 to R3.09.00

Vendor

Yokogawa Electric Corporation

Product

Versions

Affected

versions from R4.01.00 to R4.03.00
versions from R5.01.00 to R5.04.20
versions from R6.01.00 to R6.08.00

Vendor

Yokogawa Electric Corporation

Product

Versions

Affected

versions from R3.72.00 to R3.79.00

Problem Types

Type	CWE ID	Description
CWE	CWE-23	CWE-23: Relative Path Traversal

Type: CWE

CWE ID: CWE-23

Description: CWE-23: Relative Path Traversal

References

Hyperlink	Resource
https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf	x_refsource_CONFIRM

Hyperlink: https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf

Resource:

x_refsource_CONFIRM

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf	x_refsource_CONFIRM x_transferred

Hyperlink: https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf

Resource:

x_refsource_CONFIRM

x_transferred

▼National Vulnerability Database (NVD)

Source:vultures@jpcert.or.jp

Published At:11 Mar, 2022 | 09:15

Updated At:18 Mar, 2022 | 14:44

Path traversal vulnerability exists in CAMS for HIS Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	6.0	MEDIUM	AV:N/AC:M/Au:S/C:P/I:P/A:P

Type: Primary

Version: 3.1

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 6.0

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:S/C:P/I:P/A:P

CPE Matches

yokogawa>>centum_cs_3000_firmware>>Versions from r3.08.10(inclusive) to r3.09.00(inclusive)

cpe:2.3:o:yokogawa:centum_cs_3000_firmware:*:*:*:*:*:*:*:*

yokogawa>>centum_cs_3000>>-

cpe:2.3:h:yokogawa:centum_cs_3000:-:*:*:*:*:*:*:*

yokogawa>>centum_cs_3000_entry_firmware>>Versions from r3.08.10(inclusive) to r3.09.00(inclusive)

cpe:2.3:o:yokogawa:centum_cs_3000_entry_firmware:*:*:*:*:*:*:*:*

yokogawa>>centum_cs_3000_entry>>-

cpe:2.3:h:yokogawa:centum_cs_3000_entry:-:*:*:*:*:*:*:*

yokogawa>>centum_vp_firmware>>Versions from r4.01.00(inclusive) to r4.03.00(inclusive)

cpe:2.3:o:yokogawa:centum_vp_firmware:*:*:*:*:*:*:*:*

yokogawa>>centum_vp_firmware>>Versions from r5.01.00(inclusive) to r5.04.20(inclusive)

cpe:2.3:o:yokogawa:centum_vp_firmware:*:*:*:*:*:*:*:*

yokogawa>>centum_vp_firmware>>Versions from r6.01.00(inclusive) to r6.09.00(exclusive)

cpe:2.3:o:yokogawa:centum_vp_firmware:*:*:*:*:*:*:*:*

yokogawa>>centum_vp>>-

cpe:2.3:h:yokogawa:centum_vp:-:*:*:*:*:*:*:*

yokogawa>>centum_vp_entry_firmware>>Versions from r4.01.00(inclusive) to r4.03.00(inclusive)

cpe:2.3:o:yokogawa:centum_vp_entry_firmware:*:*:*:*:*:*:*:*

yokogawa>>centum_vp_entry_firmware>>Versions from r5.01.00(inclusive) to r5.04.20(inclusive)

cpe:2.3:o:yokogawa:centum_vp_entry_firmware:*:*:*:*:*:*:*:*

yokogawa>>centum_vp_entry_firmware>>Versions from r6.01.00(inclusive) to r6.09.00(exclusive)

cpe:2.3:o:yokogawa:centum_vp_entry_firmware:*:*:*:*:*:*:*:*

yokogawa>>centum_vp_entry>>-

cpe:2.3:h:yokogawa:centum_vp_entry:-:*:*:*:*:*:*:*

yokogawa>>exaopc>>Versions from r3.72.00(inclusive) to r3.80.00(exclusive)

cpe:2.3:a:yokogawa:exaopc:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-22	Primary	nvd@nist.gov
CWE-23	Secondary	vultures@jpcert.or.jp

CWE ID: CWE-22

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-23

Type: Secondary

Source: vultures@jpcert.or.jp

References

Hyperlink	Source	Resource
https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf	vultures@jpcert.or.jp	Vendor Advisory

Hyperlink: https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf

Source: vultures@jpcert.or.jp

Resource:

Vendor Advisory